patches for DPDK stable branches
 help / color / mirror / Atom feed
From: David Marchand <>
To: Quentin Armitage <>
Cc: dev <>, Harman Kalra <>,
	dpdk stable <>
Subject: Re: [PATCH v2] tap: fix write-after-free and double free of intr_handle
Date: Wed, 4 May 2022 13:17:25 +0200
Message-ID: <> (raw)
In-Reply-To: <>

On Tue, May 3, 2022 at 8:23 PM Quentin Armitage <> wrote:
> rte_pmd_tun/tap_probe() allocates pmd->intr_handle in eth_dev_tap_create()
> and it should not be freed until rte_pmd_tap_remove() is called.
> Inspection of tap_rx_intr_vec_set() shows that the call to
> tap_tx_intr_vec_uninstall() was calling rte_intr_instance_free() but
> tap_tx_intr_vec_install() can then be immediately called, and this then
> uses pmd->intr_handle without it being reallocated.
> This commit moves the call of rte_intr_instance_free() from
> tap_tx_intr_vec_uninstall() to rte_pmd_tap_remove().
> Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")

The reason is that backport scripts look for a "Cc:"
in the commitlog itself.

(no need for a v3 just for this, it can be fixed when applying)

> Changes in v2:
>   Move rte_intr_instance_free() from tap_rx_intr_vec_uninstall()
>   to tap_dev_close().

Nit: revisions changelog should be added as annotations (i.e. put
after the --- after the commitlog).

> Signed-off-by: Quentin Armitage <>

I did not test the change, but the fix lgtm.
The CI failure from UNH is a false positive.

Reviewed-by: David Marchand <>

David Marchand

  reply	other threads:[~2022-05-04 11:17 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-03 15:27 Quentin Armitage
2022-05-04 11:17 ` David Marchand [this message]
2022-05-12  8:12   ` Andrew Rybchenko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

patches for DPDK stable branches

This inbox may be cloned and mirrored by anyone:

	git clone --mirror stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ \
	public-inbox-index stable

Example config snippet for mirrors.
Newsgroup available over NNTP:

AGPL code for this site: git clone